Installing

Installing the database side of PremAgentic on a PostgreSQL you already run, the roles and files setup makes, HTTPS from the first start, and the bundled PostgreSQL on Windows.

01Installing on an existing PostgreSQL

prem setup installs the database side of PremAgentic on a PostgreSQL 14 or later that you already run (tested on 17), then searches to prove it works. Give it a role that can create roles and databases, through PREM_SETUP_ADMIN_CONNECTION or --admin-connection-file; that connection is used and never stored.

It creates two roles. The owner owns the schema and is used only for migrations and rebuild-index. The application role reads and writes rows and can do nothing else: no DDL, no ownership, no role creation. Each gets a generated password, sent to the server only as a SCRAM verifier and written only to its own credentials file (app.credentials, owner.credentials), readable only by the account that ran setup. Point PremAgentic at the application's file with PREM_CREDENTIALS_FILE, and at the owner's only to migrate or rebuild.

A third role, premagentic_search, is what searches read through: it may read documents and their chunks, which row-level security limits to what the caller may see, and nothing else. Its password goes to search.credentials, beside the application's file.

The same run can make the first administrator, with --admin-user <name>: the password is asked for at the prompt, or read from the first line of --admin-password-file, and never taken as an argument. It is made only when no administrator exists; there is never a default account.

It also makes HTTPS work from the first start: a self-signed certificate for --host-name (default: this computer's name), written with its key to https.pfx under a generated password, and kestrel.json, which tells the API to listen on https://*:8443 (--https-port to change) with that certificate. The API reads kestrel.json from the folder of its PREM_CREDENTIALS_FILE. Give clients https.crt to trust. To use your own certificate, point Certificate in kestrel.json at your PFX and its password, or at a PEM certificate and key, and restart the API; setup never replaces a certificate it did not make. The file explains this too.

Setup checks first that this computer handles Unicode text the way password hashing needs, and stops if it does not. Published builds carry their own Unicode library, so do not set DOTNET_SYSTEM_GLOBALIZATION_INVARIANT.

Run it again at any time: a finished install is left as it is, and one that stopped half way is completed. prem setup --plan shows every step and changes nothing.

02The bundled PostgreSQL on Windows

On Windows, PremAgentic can bring its own PostgreSQL 17. installer/windows/fetch-postgresql.ps1 lays out the minimal set of stock binaries from EDB's archive (checked against a pinned hash) with its license notices. It needs the Microsoft Visual C++ 2015 to 2022 x64 runtime (vc_redist.x64.exe). Then

prem setup --bundled-postgres build\postgresql\pgsql --data-dir D:\Premagentic\data --windows-service ...

makes the database cluster in the folder you choose, listening on this computer only, keeps its superuser's generated password in postgres.credentials (readable by administrators only), and runs it as the service PremagenticDb under its own account. Without --windows-service it starts the server as you, until you stop it with pg_ctl stop.